{"id":"CVE-2026-63626","revision":"fce21b6920ec416fbfa9a8e6df53d732","records":[{"revision":"fce21b6920ec416fbfa9a8e6df53d732","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-63626","aliases":[],"title":"Mongoose: ppp_handle_ipv6cp() uses attacker-controlled length without bounds check — OOB read and heap overflow (PPP/PPPoE, MG_ENABLE_IPV6)","description":"Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MG_ENABLE_TCPIP and MG_ENABLE_IPV6, an unauthenticated adjacent peer can complete the required LCP exchange and send a short Configure-Request with an oversized length, causing ppp_tx_frame() to read beyond recv_queue.buf and write beyond tx.buf. The same length misuse can also expose adjacent heap bytes in a reply or hang the event loop through find_opt(). This issue is fixed in version 7.23.","state":0,"publishedAt":"2026-10-14T18:26:16.83+00:00","modifiedAt":"2026-10-15T15:06:33.386+00:00","affected":[{"ecosystem":"Vendor product","name":"mongoose","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"cesanta\",\n                    \"product\": \"mongoose\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 7.23\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://github.com/cesanta/mongoose/security/advisories/GHSA-pc66-j6r6-49x9","https://github.com/cesanta/mongoose/commit/751f14742dea934bec08a507ab1fecc3673d4903","https://github.com/cesanta/mongoose/releases/tag/7.23"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-63626","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-63626","identifiers":["CVE-2026-63626"]},"retained":false,"historicalAffected":[]}],"coverage":[]}